8

after runnning 

ps aux

command I see this line

500  23931  0.0  0.6  63764  6880  ?  S  08:49  0:01  /usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config

I'm a beginner in this whole vps administration, so am asking if I should be worried?

Nikola
  • 777
  • 4
  • 12
  • 21

2 Answers2

8

User 500 is just a normal user. Typically user 500 was the first user on the system, recent changes (to /etc/login.defs) has altered the minimum user id to 1000 in many distributions, so typically 1000 is now the first (non root) user.

What you may be seeing is a system which has been upgraded from the old state to the new state and still has some processes knocking about on uid 500. You can likely change it by first checking if your distro should indeed now use 1000, and if so alter the login.defs file yourself, the renumber the user account in /etc/passwd and chown/chgrp all their files, usually in /home/, then reboot.

But in answer to your question, no, you should not really be worried about this in all likelihood. It'll be showing as "500" instead of a username because o user in /etc/passwd has a uid set of 500, that's all.

Also you can show your current numbers using id i'm willing to bet it comes back as 1000 for you.

edit: cjc's answer is also likely. It's hard to say without more information.

Sirex
  • 5,447
  • 2
  • 32
  • 54
  • I did a cat /etc/passwd and I found this: sw-cp-server:x:500:500::/:/bin/true. So I guess your answer would be right. Though, what more info can I give you? (am really a beginner in this unfortunatelly) – Nikola Feb 23 '12 at 10:26
  • 1
    @Nikola, you now know who is user 500. It's just a user for that sw-cp-serverd thing which is a good practice to have a unique user running a specific service so that the service has only access tho those files and folders where it has permissions. So the software (if someone somehow compromises it) can not cause any harm to your computer. – Janis Veinbergs Feb 23 '12 at 10:49
5

If ps shows just the UID of a user instead of the username, that means that the username for that UID isn't in /etc/passwd for whatever reason. UID 500 is a common first "real" user on some Linux distros.

You can investigate how the /usr/sbin/sw-cp-serverd process is being started. It's possible that root will start it and then drop privileges, but it's configured to drop privileges to a particular UID instead of a username. It's also possible that the process was started by the user with UID 500, and that user was deleted after the process started up. I'm not familiar with the specifics of the /usr/sbin/sw-cp-serverd process to say.

Update:

Huh, I have hald running as UID 68, but that UID has an entry in /etc/passwd. I'm not sure why the ps aux is displaying the UID just for that process and no other.

Anyway, back to the original question: I wouldn't be that concerned about it.

cjc
  • 24,533
  • 2
  • 49
  • 69